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I CLAIM: 


1 A computer program product for updatingawmputcr^^^ by a computer, 
said computer program product comprising: 

(i) tog detecting code operable to detect^^tbin data received by said 
compute^ tag indkaiive of existence of an updated venion of said computerfiteijand 

(ii) up date trigg ering code operable upon detection of said tag jto trigger 
downloading ftor^'altSetennin^ source to jirovide said updated version of said 
computer file for use by said compirt^ 

2. A computer program product as claimed in claim 1, wherein said tag is 
embedded within a header portion of said date. 

3. A computer program product as claimed in claim 1, wherein said data is an e- 
15 mail message. 

4. A computer program product as claimed in claim I, wherein said 
predetermined source provides one of said updated version of said computer file or 
modiiying dato for modifying said computer file currentiy used by said computer to 

20 form said i^dated version of said computer file. 

5. A computer program product as claimed in claim 1, wherein said tag includes 
a version identifier and fiirther comprising version comparing code operable to 
compare said version identifier with data indicative of a version level of said 

25 computer file to determine if an updated version of said computer file exists. 

6. A computer program product as claimed in claim I, further comprising tag 
inserting code operable to insert into data being processed by said computer a tag 
indicative of a version level of said computer file currently used by said computer. 
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7. A computer program product as claimed in claim 6. wherein said tag insetting 
code does not insert a tag if said data already includes a tag indicative of the existence 
of said version level of said computer file currently used by said computer or of the 
existence of a more recent version level of said computer file used by said computer. 
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g. A computer program product as claimed in claim 1. wherein said computer 
file is a computer virus definition data file. 

5 9. A computer program product as clamied in claim 1. wherein said computer 
file is a computer virus detection engine program file. 

10. A computer program product as claimed in claim 1. wherein said computer 
file is an anti-virus computer program file. 

10 

11. A computer program product as claimed in claim 1, wherein said tag includes 
data indicative of a version level of one or more of: 

(i) a computer virus definition data file; 

(ii) a computer virus detection engine program file; and 
,5 (iii) an anti- virus computer program file. 

12. A computer program product as claimed m claim 1. wherein said tag includes 
parameters indicative of one or more processing operations previously perfoiroed 
upon said data. 


20 
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13. A computer program product as claimed in claim 12, wherein said one or more 
processing operations are anti-virus scanning operations. 

14. A compu^r program product as claimed in claim 1. wherein said 
predetermined souA is contains an updated version of said computer file provided by 
a supplier of said computer file. 

15. A computer program product as claimed in claim 1, wherein said 
predetermined source is remote fi-om said computer. 

16. A computer program product as claimed in claim 11, wherein said 
predetermined source is accessed via an internet link. 
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17 A computer program product as claimed in claim 1. wherein said tag dau is 
encrypted tag data and said tag detecting code includes decryption code for decrypung 

said encrypted tag data. 

18 A computer program product as claimed in claim I. wherein said update 
triggering code waits for an initial update delay period Mowing detection of said tag 
before starting download of said updated version of said computer file. 

19 A computer program product as claimed in claim 1. wherein if download of 
said updated version of said computer file faUs. then said update triggering code waits 
for a failure delay period before retriggering downloading of said updated version of 
said computer file. 

20 A c\uter program product as claimed m claim 15, wherein said failure 
delay period is V "^do-random value determined by said update triggering code. 

n A computer program product as claimed in claim 1, wherein said update 
triggering code does not trigger an update if said tag indicates that said updated 
version of said computer file is more than a predetermined number of versions of 
ahead of said computer file currently used by said computer. 
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22. A computer program product comprismg: 

(i) tag inserting code operable to insert a tag within data indicating a 
version level of a computer file used by a first computer, said tag being operable to 
trigger an update of an older version of said computer file used by a second computer 
when said data is received by said second computer. 


23. A method of updating a computer file used by a computer, said method 

comprising the steps of: 
30 (i) detecting within data received by said computer a tag indicative of 

existence of an updated version of said computer file; and 

(ii) upon detection of said tag. triggering downloading from a 
predetermined source to provide said updated version of said computer file for use by 
said computer. 
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24. A method as claimed in claim 23. wherein said tag is embedded within a 
header portion of said data. 

5 25. A method as cbimed in claim 23. wherein said data is an e-mail message. 

26 A method as claimed in claim 23. wherein said predetermined source provides 
one of said updated version of said computer fUe or modifying data for modifying 
said computer file currently used by saxd computer to form said updated version of 

10 said computer file. 

27 A method as claimed m claun 23, wherein said tag includes a version 
identifier and further comprising the steps of comparing said version identifier with 
data indicative of a version level of said computer file to determine if an updated 

1 5 version of said computer file exists. 

28 A method as claimed in claim 23. further comprising the step of inserting into 
data being processed by said computer a tag indicative of a version level of said 
computer file curremly used by said computer. 

29. A method as claimed in claim 28, wherein a tag is not inserted if said data 
already includes a Ug indicative of the existence of said version level of said 
computer file currently used by said computer or of the existence of a more recent 
version level of said computer file used by said computer. 

30. A method as claimed m claim 23, wherein said computer file is a computer 
virus definition data file, 

31. A method as claimed in claim 23, wherein said computer file is a computer 
virus search engine program file. 
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32. A method as claimed in claim 23, wherein said computer file is an anti- 
computer program file. 


virus 
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33. A method as claimed in claim 23. wherein said tag includes data indicative of 
a version level of one or more of: 

(i) a computer virus definition data file; 

(ii) a computer virus detection engine program file; and 
5 (iii) an anti-virus computer program file. 

34. A method as claimed in claim 23. wherein said tag includes parameters 
indicative of one or more processing operations previously performed upon said data. 
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35. A method as claimed in claim 34, wherein said one or more processing 
operations are anti-virus scanning operations. 



36. A method as claimed in claim 23. wherein said predetermined source is 
contains an updated vcri^on of said computer file provided by a supplier of said 

is' computer file. 

37. A method as claimed in claim 23. wherein said predetermined source is 
remote from said computer. 

20 38. A method as claimed in claim 37, wherein said predetermined source is 
accessed via an internet link. 

39. A method as claimed in claim 23. wherein said tag data is encrypted tag data 
and said step of detecting includes decrypting said encrypted tag data. 


40. a' method as claimed in claim 23, further comprising the step of waiting for an 
initial update delay period following detection of said tag before starting download of 
said updated version of said computer file. 

41 . A method as claimed in claim 23, wherein if download of said updated version 
of said computer file fails, then further comprising waiting for a failure delay period 
before retriggering downloading of said updated version of said computer file. 
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42. A method as claimed in claim 41, wherein said failure deUy period is a 
psuedo-random value determined by said update triggering code. 

43. A method as claimed in clami 23, wherein an update is not triggered if said tag 
indicates that saidupdated version of said computer ffle is more than a predetermined 
number of versions of ahead of said computer file currently used by said computer. 

44. A method of operating a computer comprising the step of: 

(i) inserting a tag within data indicating a version level of a computer file 
used by a first computer, said tag being operable to trigger an update of an older 
version of said computer file used by a second computer when said data is received by 
said second computer. 

45. Apparatus for updating a computer file used by a computer, said apparatus 
comprising: 

(i) tag detecting logic operable to detect within data received by said 
computer a tag indicative of existence of an updated version of said computer file; and 

(ii) update triggering logic operable upon detection of said tag to trigger 
dowrUoading from a predetermined source to provide said updated version of said 
computer file for use by said computer. 

46. Apparatus as claimed in claim 44, wherein said tag is embedded within a 
header portion of said data, 

47. Apparatus as claimed in claim 44, wherein said data is an e-mail message. 

48. Apparatus as claimed in claim 44, wherein said predetermined source provides 
one of said updated version of said computer filer or modifying data for modifying 
said computer file currently used by said computer to form said updated version of 
said computer file. 

49. Apparams as claimed in claim 45, wherein said tag includes a version 
identifier and fiirther comprising version comparing logic operable to compare said 
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version identifier with daia indicative of a version level of said computer file to 
determine if an updated version of said computer file exists. 

50 Apparatus as claimed in claim 45. fimher comprising tag inserting logic 
5 operable to insert into data being processed by said computer a tag indicative of a 

version level of said computer file cunently used by said computer. 

51 Apparatus as claimed in claim 50, wherein said tag inserting logic does not 
insert a ug if said data already includes a tag indicative of the existence of said 

JO version level of said computer file currently used by said computer or of the existence 
of a more recent version level of said computer file used by said computer. 
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52. Apparatus as claimed in claim 45, wherein said computer file is a computer 

virus definition data file. 

53. Apparaws as claimed in claim 45, wherein said computer file is a computer 
virus detection engine program file. 

54. Apparatus as claimed in claim 45, wherein said computer file is an anti-virus 

20 computer program file. 

55. Apparatus as claimed in claim 45. wherein said tag includes data indicative of 

a version level of one or more of. 

(i) a computer virus detinition data file; 
25 (ii) a computer virus detection engine program file; and 

(iii) an anti-virus computer program file. 

56. Apparatus as claimed in claim 45, wherein said tag includes parameters 
indicative of one or more processing operations previously performed upon said data. 
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57. Apparanis as claimed in claim 56. wherein said one or more processing 
operations are anti-virus scanning operations. 
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58. Apparaius \ claimid in claim 45. wherein said predetennined source is 
contains an updatel version of said computer file provided by a supplier of said 
computer file. \ 

59. Apparatus as 'claimed in claim 45. wherein said predetermined source is 
remote from said computer. 

60. Apparatus as claimed in claim 45, wherein said predetermined source is 
accessed via an internet link. 

61 . Apparatus as claimed in claim 45, wherein said tag data is encrypted tag data 
and said tag detecting logic includes decryption logic for decrypting said encrypted 
tag data. 

62. Apparatus as claimed in claim 45, wherein said update triggering logic waits 
for an initial update delay period following detection of said tag before starting 
download of said updated version of said coinputer file. 

63. Apparatus as claimed in claim 45, wherein if download of said updated 
0 version of said computer file fails, then said update triggering logic waits for a failure 

delay period before retriggering downloading of said updated version of. said 
computer file. 

64. Apparams as claimed in claim 63. wherein said failure delay period is a 
!5 psuedo-random value determined by said update triggering logic. 

65. Apparatus as claimed in claim 45, wherein said update triggering logic does 
not trigger an update if said tag indicates that said updated version of said computer 
file is more than a predetermined number of versions of ahead of said computer file 

30 currently used by said computer. 

66. Apparatus for inserting a ug within data, said apparams comprising: 

(i) tag inserting logic operable to insert a tag within data indicating a 
version level of a computer file used by a first computer, said tag being operable to 
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ttigger an update of an older version of said computer ffle used by a second computer 
when said e-mail is received by said second computer. 
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